It’s also possible for companies to register for a free, informal disclosure program through HackerOne’s website, where anyone can voluntarily share information about a vulnerability with the participating party. Payouts for the firm’s contractors differs on the program they’re working on, type of vulnerability and client being served.

HackerOne has conducted approximately 860 programs this year - not all were paid. The average bounty paid to hackers for a critical vulnerability was $1,923 in 2017, compared to $1,624 in 2015 - an increase of 16 percent. The top performing bug bounty programs pay hackers an average of $50,000 per month. The company’s strength, Mickos described, comes from its diverse community of researchers, which it can tap into for different bug hunting programs. The approach is relatively hands off and inclusive registration for users is open, the application for open jobs is simple, and an open review system helps qualify the expertise of individual hackers. HackerOne runs both public and private programs, with the latter sometimes including a more exclusive and selective hiring process. Broadly speaking, this model comes with certain pros and cons. For example, HackerOne’s crowdsourcing model is meant to be open and welcoming from a researcher standpoint, but that structure can also occasionally scare off potential customers who store more sensitive data. In the future, Mickos hopes to expand HackerOne’s client base by working with both large corporations and governmental agencies, who he predicts will become increasingly receptive to crowdsourced bug bounty programs. “This fear about bug bounty programs, it will change, I think people will realize that what we offer is safe … even the more sensitive customers will be more receptive. ” Structure is identityīeing able to serve a sensitive customer base, which already includes the Internal Revenue Service, is what sets Synack apart, according to company cofounder Mark Kuhr. Synack was created by two former NSA analysts. The researcher community involved with the company began as an extension of Kuhr and co-founder Jay Kaplan’s personal network of contacts.

Synack admittedly has less researchers than HackerOne - Kuhr described it as “several hundred” - and it isn’t looking to greatly increase that number. We spend a lot of time trying to find the right people,” said Kuhr, “and that gives us an advantage.” “What makes us special is that we screen, interview and hold our researchers to a very high standard. This recruitment method is inherently exclusive, involves requesting personal information upfront from researchers and includes non-disclosure agreements.

Western union bug software download